- Freeradius-Users - lists.freeradius.org

Can't start Freeradius with non-root user
by Jeanderson Soares 29 Jun '16

29 Jun '16

Hello, everyone I'm having a problem when running freeradius with a non-root user/group. The service can't start because of permissions on log and pid files. When started in debug mode, the service starts and works fine, but fails in production: # radiusd radiusd: Failed to open log file /usr/local/var/log/radius/radius.log: Permission denied Changed the folder owner, but still got same error # chown -R radius:radius /usr/local/var/log/radius/ # radiusd radiusd: Failed to open log file /usr/local/var/log/radius/radius.log: Permission denied If I specify the file, freeradius can create log file but shows nothing on output # radiusd -l /usr/local/var/log/radius/radius.log # Cheking de log file, happens the same with the pid file: Error: Failed creating PID file /usr/local/var/run/radiusd/radiusd.pid: Permission denied Again, changed the folder owner, but still got same error # chown -R radius:radius /usr/local/var/run/radiusd/ Running with commented user and group options, the service works fine. I'm on Debian 8.0.3 and Freeradius 3.0.11 Freeradius was compiled with default options. The user was created with: useradd -r -d /usr/local/etc/raddb/ -s /bin/false radius Thanks for any help.

2 3

Specifying NAS-IP-Address in eapol_test CLI
by Alex Sharaz 29 Jun '16

29 Jun '16

o.k. the man page isn't very helpful I want to pass a value for NAS-IP-Address to eapol_test as an argument. the man page says -N attr spec Send arbitrary attribute specific by attr_id:syntax:value, or attr_id alone. attr_id should be the numeric ID of the attribute, and syntax should be one of 's' (string), 'd' (integer), or 'x' (octet string). The value is the attribute value to send. When attr_id is given alone, NULL is used as the attribute value. Multiple attributes can be specified by using the option several times. so I wanted to pass 144.32.126.139 as the NAS-IP-Address I've tried eapol_test -c /usr/local/etc/peap-ydh.conf -A 144.32.126.139 -a 144.32.128.68 -s <key> -N 61:d:15 -N 6:d:8 -N 4:s:144.32.126.139 but that gives me Attribute 4 (NAS-IP-Address) length=16 Invalid IP address length 14 Putting the address in quotes makes no difference other even tried -N 4:x:061064064056063062056061062066054061063071 which should be 144.32.126.139 in octal Still got an invalid IP address Length Any Ideas? A

2 2

Crash in 3.1 git
by Wegener, Norbert 29 Jun '16

29 Jun '16

This morning I got the sources via: $ git clone https://github.com/FreeRADIUS/freeradius-server.git $ cd freeradius-server $ git checkout -b v3.1.x origin/v3.1.x I built and configured the server, it starts fine. When receiving a request from a radtest client it crashes. "Datei oder Verzeichnis nicht gefunden" means "File not found". Here is what gdb outputs: (gdb) set args -X (gdb) run ... Ready to process requests ASSERT FAILED src/main/process.c[1843]: request->server_cs != NULL RAISING SIGNAL: Aborted Program received signal SIGABRT, Aborted. 0x00007ffff647d79b in raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/pt-raise.c:37 37 ../nptl/sysdeps/unix/sysv/linux/pt-raise.c: Datei oder Verzeichnis nicht gefunden. (gdb) bt #0 0x00007ffff647d79b in raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/pt-raise.c:37 #1 0x00007ffff794c40e in fr_fault (sig=6) at src/lib/debug.c:650 #2 0x00007ffff7bbb77c in rad_assert_fail (file=0x475202 "src/main/process.c", line=1843, expr=0x475adf "request->server_cs != NULL") at src/main/util.c:468 #3 0x000000000044756d in request_setup (ctx=0xeeb9e0, listener=0x9e97b0, packet=0xeeba40, client=0xd418b0, fun=0x410f10 <rad_authenticate>) at src/main/process.c:1843 #4 0x00000000004471fb in request_receive (ctx=0xeeb9e0, listener=0x9e97b0, packet=0xeeba40, client=0xd418b0, fun=0x410f10 <rad_authenticate>) at src/main/process.c:1740 #5 0x000000000041f64c in auth_socket_recv (listener=0x9e97b0) at src/main/listen.c:1906 #6 0x000000000044e752 in event_socket_handler (xel=0xedd4c0, fd=55, ctx=0x9e97b0) at src/main/process.c:4563 #7 0x00007ffff7977905 in fr_event_loop (el=0xedd4c0) at src/lib/event.c:636 #8 0x00000000004506ad in radius_event_process () at src/main/process.c:5458 #9 0x0000000000434d62 in main (argc=2, argv=0x7fffffffe618) at src/main/radiusd.c:584 (gdb) Norbert Wegener

3 3

Strange behavior, could it be FR-related ?
by Hoggins! 29 Jun '16

29 Jun '16

Hello, I'm pretty sure what I'm seeing is related to the client I'm using, but I think it's quite odd : the client is ProFTPd, and it's a login phase. I'm sending user : unlogindeplus and pass : toast But what I see in FR logs in debug mode is quite surprising : <snip> (5) User-Name = "unlogindeplus" (5) User-Password = "toast\000ndtoast" (5) NAS-Identifier = "ftps" (5) NAS-IPv6-Address = ::ffff:188.165.117.231 (5) NAS-Port = 21 (5) NAS-Port-Type = Virtual (5) Calling-Station-Id = "217.114.201.133" (5) Service-Type = Login-User <snip> As you can see, FR "sees" User-Password : "toast\000ndtoast" and not simply "toast". I'm puzzled. Thanks ! Hoggins!

2 3

ERROR: SSL says error 7 : certificate signature failure
by craig 29 Jun '16

29 Jun '16

Hi, 802.1x Authentication with EAP-TLS, works perfectly with a Centos client, however not from a Cisco IP Phone. Basic Specs For Server; * Centos 7.2 x64 * freeradius-3.0.11 * Communicating through a Dell N3000 switch. * Cisco 7945 IP Phone I'm just after advice on how to solve the "certificate signature failure" error? Error: (3) eap_tls: Creating attributes from certificate OIDs (3) eap_tls: TLS-Cert-Serial := "01" (3) eap_tls: TLS-Cert-Expiration := "190622025857Z" (3) eap_tls: TLS-Cert-Subject := "/CN=ios-ca" (3) eap_tls: TLS-Cert-Issuer := "/CN=ios-ca" (3) eap_tls: TLS-Cert-Common-Name := "ios-ca" (3) eap_tls: Creating attributes from certificate OIDs (3) eap_tls: TLS-Client-Cert-Serial := "02" (3) eap_tls: TLS-Client-Cert-Expiration := "190622025857Z" (3) eap_tls: TLS-Client-Cert-Subject := "/CN=SEP20BBC092DE1D" (3) eap_tls: TLS-Client-Cert-Issuer := "/CN=ios-ca" (3) eap_tls: TLS-Client-Cert-Common-Name := "SEP20BBC092DE1D" ---> (3) eap_tls: ERROR: SSL says error 7 : certificate signature failure <------- (3) eap_tls: >>> send TLS 1.0 Alert [length 0002], fatal decrypt_error (3) eap_tls: ERROR: TLS Alert write:fatal:decrypt error tls: TLS_accept: Error in SSLv3 read client certificate B (3) eap_tls: ERROR: SSL says: error:0D0C50A1:asn1 encoding routines:ASN1_item_verify:unknown message digest algorithm (3) eap_tls: ERROR: SSL_read failed inside of TLS (-1), TLS session failed (3) eap_tls: ERROR: TLS receive handshake failed during operation (3) eap_tls: ERROR: [eaptls process] = fail (3) eap: ERROR: Failed continuing EAP TLS (13) session. EAP sub-module failed Regards, Craig

2 1

Regarding EAP-AKA
by Ravisankar 29 Jun '16

29 Jun '16

Hi , I am using FreeRADIUS Version 3.0.11, When I try to confiugre eap-aka, I get the error "rlm_eap (EAP): Failed to link rlm_eap_aka: /usr/local/lib/rlm_eap_aka.so: cannot open shared object file: No such file or directory /usr/local/etc/raddb/mods-enabled/eap[14]: Instantiation failed for module "eap" Could you please help me in resolving this issue. Thanks, Ravisankar

3 3

pure joy
by bunkertor＠tiscali.it 28 Jun '16

28 Jun '16

Hi, I wanted to share with you my joy about my latest event, please read more here <http://trelopize.floridacitygames.com/oxwbvmg> Best, bunkertor(a)tiscali.it

1 0

freeradius -X crashes
by Henrik Kressner 28 Jun '16

28 Jun '16

I am using: freeradius -v freeradius: FreeRADIUS Version 2.2.5, for host i586-pc-linux-gnu, built on Oct 24 2014 at 04:18:43 Running on a Alix computer with a Voyage Version: 0.10.0 with IP 192.168.1.5 (Voyage is a Debian derivetive) with hostapd -v hostapd v2.3 User space daemon for IEEE 802.11 AP management, IEEE 802.1X/WPA/WPA2/EAP/RADIUS Authenticator Copyright (c) 2002-2014, Jouni Malinen <j(a)w1.fi> and contributors On a RPI3 with IP 192.168.1.30 as a NAS/AP. From the RPI3 I can use # radtest tst password 192.168.1.5 0 secret123 with succes. So I expect hostapd and freeradius to be corect configered? Here comes the problem: I followed the howto to this point: http://deployingradius.com/documents/configuration/pap.html I tryid to disable validate server certificate, on a windows 7, but it stil ends op showing me: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: !! EAP session for state 0x3e833be03884222b... did not finish! WARNING: !! Please read http://wiki.freeradius.org/guide/Certificate_Compatibility WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! So I expect a certificate problem and follow this howto: http://deployingradius.com/documents/configuration/certificates.html This does not work as expectid. When I run # freeradius -X No change. I suspect the certificates is not moved to where they should be. (They are in: /usr/share/doc/freeradius/examples/certs So I copy the cerificate into: /etc/freeradius/certs and check the rights. It looks like the original, but its no link. /etc/freeradius# ls -l certs -rw-r--r-- 1 root freerad 1700 Jun 28 15:11 ca.pem -rw-r--r-- 1 root freerad 1834 Jun 28 15:13 server.key -rw-r--r-- 1 root freerad 3609 Jun 28 15:11 server.pem Now when i run: # freeradius -X It crashes with this: ....... url ="http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } rlm_eap: SSL error error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt rlm_eap_tls: Error reading private key file /etc/freeradius/certs/server.key rlm_eap: Failed to initialize type tls /etc/freeradius/eap.conf[17]: Instantiation failed for module "eap" /etc/freeradius/sites-enabled/default[310]: Failed to find "eap" in the "modules" section. /etc/freeradius/sites-enabled/default[252]: Errors parsing authenticate section. /etc/freeradius# Then I am a little lost. Any idea? -- ------------------------------------------- Med venlig hilsen / Yours Sincerly Henrik Kressner

5 8

Apache Free Radius module error
by Jeevan Mithyantha 28 Jun '16

28 Jun '16

Hi, For one of my projects I have to set up two factor authentication. I have used Apache Free Radius module which acts as a client to Radius server. This setup is already been done and 2FA is working fine. But, I'm having an issue. If I get authenticated, it will stay authenticated (forever apparently) in both FF and IE browser, also if I supply invalid username or password, I get a "Authorization Required" response (that apparently stays forever too). But, In Chrome I didn't notice this behavior. Whenever I refresh the page, it apparently prompts for the username and password. Can someone please suggest on this. Thanks in advance. -- Thanks and Regards, Jeevan Mithyantha

2 3

Captive portal with freeradius
by Kouata Modibo 28 Jun '16

28 Jun '16

Hi, I'm using FreeRADIUS Version 2.2.5 I would like to use the captive portal feature with freeradius. In other word when freeradius can't authentificate an user, before reject, it redirects user to a captive portal for authentificating it, (accept according of this result) like ldap module. It is possible? thank you.

2 1